Microsoft Security Bulletin MS14-061 - Important

In this article

General Information

Executive Summary

This security update resolves one privately reported vulnerability in Microsoft Office. The vulnerability could allow remote code execution if an attacker convinces a user to open a specially crafted Microsoft Word file. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

The security update addresses the vulnerability by correcting the way that Microsoft Office parses specially crafted files. For more information about the vulnerability, see the Frequently Asked Questions (FAQ) subsection for the specific vulnerability later in this bulletin.

Recommendation. Customers can configure automatic updating to check online for updates from Microsoft Update by using the Microsoft Update service. Customers who have automatic updating enabled and configured to check online for updates from Microsoft Update typically will not need to take any action because this security update will be downloaded and installed automatically. Customers who have not enabled automatic updating need to check for updates from Microsoft Update and install this update manually. For information about specific configuration options in automatic updating, see Microsoft Knowledge Base Article 294871.

For administrators and enterprise installations, or end users who want to install this security update manually (including customers who have not enabled automatic updating), Microsoft recommends that customers apply the update at the earliest opportunity using update management software, or by checking for updates using the Microsoft Update service. The updates are also available via the download links in the Affected Software table later in this bulletin.

For customers of Microsoft Office for Mac, Microsoft AutoUpdate for Mac can be configured to deliver updates for Microsoft software directly to your system. For more information, see Check for Office for Mac updates automatically.

See also the section, Detection and Deployment Tools and Guidance, later in this bulletin.

Knowledge Base Article

Affected Software

The following software versions or editions are affected. Versions or editions that are not listed are either past their support life cycle or are not affected. To determine the support life cycle for your software version or edition, see Microsoft Support Lifecycle.

Update FAQ

I am being offered this update for software I do not have installed on my system. Why am I being offered this update?Due to the servicing model for Microsoft Office updates, you may be offered updates for software that you do not have installed on your system. For example, you may be offered an update for a Microsoft Office product even though you do not have the specific Office product installed. For more information on this behavior and recommended actions, see Microsoft Knowledge Base Article 830335.

What updates apply to Microsoft SharePoint Server 2010?For supported editions of Microsoft SharePoint Server 2010, the following update applies only to the specific component:

Word Automation Services (2883098)

Note By default, Word Automation Services is a service that installs and runs with a stand-alone SharePoint Server 2010 installation. If you are using SharePoint Server 2010 in a server farm, you must explicitly enable Word Automation Services.

Microsoft Web Applications 2010 is an optional feature that can be deployed on SharePoint Server 2010 and SharePoint Foundation 2010 installations.

I am being offered this update for software that is not specifically listed in the Affected Software table. Why am I being offered this update?When updates address vulnerable code that exists in a component that is shared between multiple Microsoft Office products or shared between multiple versions of the same Microsoft Office product, the update is considered to be applicable to all supported products and versions that contain the vulnerable component.

For example, when an update applies to Microsoft Office 2007 products, only Microsoft Office 2007 may be specifically listed in the Affected Software table. However, the update could apply to Microsoft Word 2007, Microsoft Excel 2007, Microsoft Visio 2007, Microsoft Compatibility Pack, Microsoft Excel Viewer, or any other Microsoft Office 2007 product that is not specifically listed in the Affected Software table.

For example, when an update applies to Microsoft Office 2010 products, only Microsoft Office 2010 may be specifically listed in the Affected Software table. However, the update could apply to Microsoft Word 2010, Microsoft Excel 2010, Microsoft Visio 2010, Microsoft Visio Viewer, or any other Microsoft Office 2010 product that is not specifically listed in the Affected Software table.

For more information on this behavior and recommended actions, see Microsoft Knowledge Base Article 830335. For a list of Microsoft Office products an update may apply to, refer to the Microsoft Knowledge Base Article associated with the specific update.

I am being offered this update for software that is not vulnerable. Why am I being offered this update?In some cases, an update may apply to Microsoft Office products that are specifically listed in the Non-Affected Software table or that are otherwise listed in the Affected Software table with "Not applicable" for security impact. For example, you may be offered a Microsoft Office security update even though this security bulletin indicates that the Office products or the version of the Office products that you do have installed are not affected. For more information on this behavior, see Microsoft Knowledge Base Article 830335.

Although updates may be available for the non-vulnerable software, users who choose not to apply these updates will not increase the security risk for their system. However, Microsoft recommends that users install all updates offered to their systems. This helps to maintain consistency for shared files across Office products. In some cases, an update to non-vulnerable software detects that the files on your system are already up-to-date and as a result, the update does not need to install files.

I have Microsoft Word 2010 installed. Why am I not being offered the 2883008 update?The 2883008 update only applies to systems running specific configurations of Microsoft Office 2010. Other systems will not be offered the update.

Does the offer to update a non-vulnerable version of Microsoft Office software constitute an issue in the servicing model for Microsoft Office updates?No. The servicing model is based on how the update applies to shared components of Microsoft Office software. Some of the products offered an update may not access the vulnerable code, and thus the software is not affected by the vulnerability. However, the update mechanism is functioning correctly in that it detects a product version for applicable software on the system that is within the range of product versions that the update applies to, and thus offers the update. This helps to maintain consistency for shared files across Office products.

What components of the Microsoft Office Compatibility Pack are updated by this bulletin?The update included with this security bulletin applies only to the specific component within the Microsoft Office Compatibility Pack that is affected. For example, in an Microsoft Word bulletin, only the Word compatibility pack component files are included in the update packages and not Excel or PowerPoint compatibility pack component files. Excel compatibility pack component files are updated in an Excel bulletin, and PowerPoint compatibility pack component files are updated in a PowerPoint bulletin.

How is Microsoft Outlook affected by the vulnerability?Outlook is not directly affected because the vulnerability is present in Microsoft Word; but, if Word is the selected email reader, as is the default case in Microsoft Outlook 2007 and Outlook 2010, then an attacker could leverage Outlook for an email attack vector to exploit CVE-2014-4117 by sending a specially crafted email message to the target email recipient.

I am using an older release of the software discussed in this security bulletin. What should I do?The affected software listed in this bulletin has been tested to determine which releases are affected. Other releases are past their support life cycle. For more information about the product lifecycle, see the Microsoft Support Lifecycle website.

Customers who require custom support for older software must contact their Microsoft account team representative, their Technical Account Manager, or the appropriate Microsoft partner representative for custom support options. Customers without an Alliance, Premier, or Authorized Contract can contact their local Microsoft sales office. For contact information, see the Microsoft Worldwide Information website, select the country in the Contact Information list, and then click Go to see a list of telephone numbers. When you call, ask to speak with the local Premier Support sales manager. For more information, see the Microsoft Support Lifecycle Policy FAQ.

Severity Ratings and Vulnerability Identifiers

The following severity ratings assume the potential maximum impact of the vulnerability. For information regarding the likelihood, within 30 days of this security bulletin's release, of the exploitability of the vulnerability in relation to its severity rating and security impact, please see the Exploitability Index in the October bulletin summary. For more information, see Microsoft Exploitability Index.

Microsoft Word File Format Vulnerability - CVE-2014-4117

A remote code execution vulnerability exists in way that Microsoft Office software parses certain properties of Microsoft Word files. If an attacker is successful in exploiting this vulnerability, and if the current user is logged on with administrative user rights, the attacker could take complete control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

To view this vulnerability as a standard entry in the Common Vulnerabilities and Exposures list, see CVE-2014-4117.

Mitigating Factors

Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity of exploitation of a vulnerability. The following mitigating factors may be helpful in your situation:

The vulnerability cannot be exploited automatically through email. For an attack to be successful a user must open an attachment that is sent in an email message.

In a web-based attack scenario, an attacker could host a website that contains a specially crafted Office file that is used to attempt to exploit this vulnerability. In addition, compromised websites and websites that accept or host user-provided content or advertisements could contain specially crafted content that could exploit this vulnerability. In all cases, however, an attacker would have no way to force users to view attacker controlled content. Instead, an attacker would have to convince users to take action, typically by getting them to click a link in an email message or Instant Messenger message that takes users to the attacker’s website, and then convince them to open the specially crafted Office file.

An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

Workarounds

Workaround refers to a setting or configuration change that does not correct the underlying vulnerability but would help block known attack vectors before you apply the update. Microsoft has tested the following workarounds and states in the discussion whether a workaround reduces functionality:

Do not open Office files that you receive from untrusted sources or that you receive unexpectedly from trusted sourcesDo not open Office files that you receive from untrusted sources or that you receive unexpectedly from tursted sources. This vulnerability could be exploited when a user opens a specially crafted file.

FAQ

What is the scope of the vulnerability?This is a remote code execution vulnerability in the context of the current user.

What causes the vulnerability?The vulnerability is caused when Microsoft Word does not properly handle objects in memory while parsing specially crafted Office files. System memory may be corrupted in such a way that an attacker could execute arbitrary code.

What might an attacker use the vulnerability to do?An attacker who successfully exploited this vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

How could an attacker exploit the vulnerability?Exploitation of this vulnerability requires that a user open a specially crafted file with an affected version of Microsoft Office software.

In an email attack scenario, an attacker could exploit the vulnerability by sending a specially crafted file to the user and by convincing the user to open the file in an affected version of Microsoft Office software.

In a web-based attack scenario, an attacker could host a website that contains a file that is used to attempt to exploit the vulnerability. In addition, compromised websites and websites that accept or host user-provided content could contain specially crafted content that could exploit this vulnerability. An attacker would have no way to force users to visit a specially crafted website. Instead, an attacker would have to convince them to visit the website, typically by getting them to click a link in an email message or Instant Messenger message that takes them to the attacker's site, and then convince them to open the specially crafted file in an affected version of Microsoft Office software.

What systems are primarily at risk from the vulnerability?Systems where affected Microsoft Office software is used, including workstations and terminal servers, are primarily at risk. Servers could be at more risk if system administrators allow users to log on to servers and to run programs. However, best practices strongly discourage allowing this.

What does the update do?This update addresses the vulnerability by correcting the way that Microsoft Office parses specially crafted files.

When this security bulletin was issued, had this vulnerability been publicly disclosed?No. Microsoft received information about this vulnerability through coordinated vulnerability disclosure.

When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited?No. Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers when this security bulletin was originally issued.

Detection and Deployment Tools and Guidance

Several resources are available to help administrators deploy security updates.

In some cases, this update does not require a restart. If the required files are being used, this update will require a restart. If this behavior occurs, a message appears that advises you to restart.

To help reduce the chance that a restart will be required, stop all affected services and close all applications that may use the affected files prior to installing the security update. For more information about the reasons why you may be prompted to restart, see Microsoft Knowledge Base Article 887012.

In some cases, this update does not require a restart. If the required files are being used, this update will require a restart. If this behavior occurs, a message appears that advises you to restart.

To help reduce the chance that a restart will be required, stop all affected services and close all applications that may use the affected files prior to installing the security update. For more information about the reasons why you may be prompted to restart, see Microsoft Knowledge Base Article 887012.

Office for Mac 2011

Download and install the appropriate language version of the Microsoft Office for Mac 2011 14.4.5 Update from the Microsoft Download Center.

Quit any applications that are running, including virus-protection applications and all Microsoft Office applications as they could interfere with the installation.

Open the Microsoft Office for Mac 2011 14.4.5 Update volume on your desktop. This step might have been performed for you.

To start the update process, in the Microsoft Office for Mac 2011 14.4.5 Update volume window, double-click the Microsoft Office for Mac 2011 14.4.5 Update application, and follow the instructions on the screen.

When the installation finishes successfully, you can remove the update installer from your hard disk. To verify that the installation finished successfully, see Verifying Update Installation. To remove the update installer, first drag the Microsoft Office for Mac 2011 14.4.5 Update volume to the Trash, and then drag the file that you downloaded to the Trash.

Verifying Update Installation

To verify that a security update is installed on an affected system, follow these steps:

In Finder, navigate to the Application Folder (Microsoft Office 2011).

Select Word, Excel, PowerPoint or Outlook and launch the application.

On the application menu, click About Application_Name (where Application_Name is Word, Excel, PowerPoint or Outlook).

If the Latest Installed Update Version number is 14.4.5, the update has been successfully installed.

Restart Requirement

This update does not require you to restart your computer.

Removing the Update

This security update cannot be uninstalled.

Additional Information

If you have technical questions or problems downloading or using this update, see Microsoft for Mac Support to learn about the support options that are available to you.

SharePoint Server 2010 (all editions)

Reference Table

The following table contains the security update information for this software.

In some cases, this update does not require a restart. If the required files are being used, this update will require a restart. If this behavior occurs, a message appears that advises you to restart.

To help reduce the chance that a restart will be required, stop all affected services and close all applications that may use the affected files prior to installing the security update. For more information about the reasons why you may be prompted to restart, see Microsoft Knowledge Base Article 887012.

In some cases, this update does not require a restart. If the required files are being used, this update will require a restart. If this behavior occurs, a message appears that advises you to restart.

To help reduce the chance that a restart will be required, stop all affected services and close all applications that may use the affected files prior to installing the security update. For more information about the reasons why you may be prompted to restart, see Microsoft Knowledge Base Article 887012.

Acknowledgments

Microsoft thanks the following for working with us to help protect customers:

3S Labs, working with HP'sZero Day Initiative, for reporting the Microsoft Word File Format Vulnerability (CVE-2014-4117)

Other Information

Microsoft Active Protections Program (MAPP)

To improve security protections for customers, Microsoft provides vulnerability information to major security software providers in advance of each monthly security update release. Security software providers can then use this vulnerability information to provide updated protections to customers via their security software or devices, such as antivirus, network-based intrusion detection systems, or host-based intrusion prevention systems. To determine whether active protections are available from security software providers, please go to the active protections websites provided by program partners, listed in Microsoft Active Protections Program (MAPP) Partners.

Disclaimer

The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Revisions

V1.0 (October 14, 2014): Bulletin published.

Page generated 2014-10-14 10:07Z-07:00.

Note

The feedback system for this content will be changing soon. Old comments will not be carried over. If content within a comment thread is important to you, please save a copy. For more information on the upcoming change, we invite you to read our blog post.